Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Initialize and script ActiveX controls not marked as safe

This policy controls whether ActiveX controls in the Local intranet zone can be initialized, loaded with parameters, and accessed by scripts when they are not marked as safe for untrusted data or scripting.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1201
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1201

This policy controls whether ActiveX controls in the Local intranet zone can be initialized, loaded with parameters, and accessed by scripts when they are not marked as safe for untrusted data or scripting. The 1201 value represents the URL security action that governs overriding ActiveX object safety.

The value uses the REG_DWORD data type:

  • 0 allows initialization and scripting without prompting.
  • 1 asks the user whether the control may be loaded with parameters or scripted.
  • 3 prevents parameterized loading and scripting when the control cannot be made safe.

The setting applies only to content that Windows assigns to security zone 1, the Local intranet zone.

Notes

Additional effects

With value 0, both unsafe and safe controls are initialized and scripted. This overrides the separate zone option governing the scripting of ActiveX controls marked safe for scripting.

The policy does not install or download ActiveX controls. Other policies or security features governing ActiveX execution, add-ons, or executable content can still prevent a control from being used.

Security

Value 0 bypasses object-safety enforcement for untrusted data and scripts. Intranet content can therefore invoke methods and capabilities exposed by an installed ActiveX control even though its developer has not declared that use safe.

The resulting risk depends on the control. A vulnerable or inappropriately exposed control might allow content to disclose data, modify files or settings, or perform other native operations within the security context and restrictions of the browser process and signed-in user. This setting does not itself grant administrative privileges or generally bypass operating-system permissions and other security controls.

Value 1 retains a user decision as an additional barrier, but it cannot prevent mistaken consent or deceptive prompts. Value 3 blocks this form of initialization and scripting for controls that cannot be made safe.

Possible side effects

Value 3 can break or limit legacy intranet applications that depend on controls not marked safe for the required data or scripting interaction. Value 1 can interrupt those applications with recurring security prompts.

Notes

The HKLM path represents the computer policy, while the HKCU path represents the user policy.

This setting affects Internet Explorer technology and applications that use its security-zone and ActiveX infrastructure. Native Microsoft Edge does not support ActiveX. Pages running in Microsoft Edge Internet Explorer mode can use ActiveX controls and Internet Explorer policies that affect security-zone settings.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – IntranetZoneInitializeAndScriptActiveXControls

Microsoft Learn: What is Internet Explorer mode?

Microsoft Learn: URL Policy Flags

See also